December 2003 - cypherpunks-legacy

Domain registration
by David Mazieres 17 Dec '03

17 Dec '03

Well, several people have told me it is possible to get response times of 8 hours on domain registration requests. The last MODIFY request I sent in was in mid January. They sent back an autoreply telling me they were still working on modify requests from the third week in december, and then didn't change my domain until last week. (The inaddr.arpa modify request was considerably faster, however.) Maybe they just don't like me, or maybe they have very very recently automated the process. At any rate, I stand corrected. David

2 1

cypher-list noise levels
by Jonathon Fletcher 17 Dec '03

17 Dec '03

Hi, Can someone on the PGPdomo cypher-list tell me how good the signal to noise ratio currently is, and how good the content is. I've not signed up, but I'm tempted to try and get away from the noise on here recently. -Jon -- Jonathon Fletcher <jonathon(a)pobox.com>

2 1

Crypto-smart-card startup Inside Technologies
by Peter Monta 17 Dec '03

17 Dec '03

There's an article in the January 29 _EE Times_ about a French cryptographic-smart-card startup called Inside Technologies. Tidbits: ..."In public-key cryptography, 512-bit keys are typical and already vulnerable. So we are looking at 640-bit-long keys supported by a scalable design." ..."Users want their own, custom algorithms, which can be downloaded at the time of use". ..."The CLU [cryptographic logic unit] will operate at a higher clock frequency than the RISC---60 MHz, in our design---yielding 640-bit RSA decrypt in less than 50 ms". The article goes on to say that they plan to both manufacture smart cards, presumably for ecash and communications, and license the design at the macrocell level, possibly for use in embedded systems like mass storage. By my count, six European companies mentioned, zero American. Cheers, Peter Monta pmonta(a)qualcomm.com Qualcomm, Inc./Globalstar

2 1

Re: Downsizing the NSA
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

A semiparanoid thought struck me: Maybe the NSA doesn't these extra 20K people, they just don't want them to go out into the industry and build crypto for the outside world. So they continue to pay them salaries and have them do nothing useful. This would be kind of analogous to how when Russia no longer needed so many nuclear scientists, the U.S. helped create "make work" jobs for them, just so they wouldn't go to work for the likes of Iraq. --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Freedom of speech question...
by Jim Choate 17 Dec '03

17 Dec '03

It is a commenly held belief that shouting 'fire' in a crowded theatre is a crime because of the potential for harm to persons and property. It is one of the most commen examples given for limiting freedom of speech even though the Constitution says "Congress shall make no law...". This view is proposed as a equaly valid rationale for limiting crypto, virus technology, drugs, etc. My question to the list is would it be a crime if you were alone in the theatre? If you developed a virus and didn't distribute it would that be a crime? If you give it to one person is it a crime? How about if you give it to millions? How many people must know a fact, posses source code or executable. In short, does freedom of speech rest on how many people are aware of your expression? My position is that if you answer in the affermative then you are basicaly stating there is no freedom of speech. It should be perfectly permissible to shout 'fire' in a theatre filled to the brim. If anyone takes you seriously and is harmed then you should be liable for the damage. Your right to shout 'fire' is not relevant. If you accept the premise then what you are buying into is preemptive justice, in short judging somebody guilty by what they might do, not what they have done. If this is permitted then we have a serious problem in that anyperson is therefore guilty of whatever crime is desired.

2 1

Re: Crypto-smart-card startup Inside Technologies
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09:41 PM 1/31/96 -0800, Peter Monta wrote: >jim bell <jimbell(a)pacifier.com> writes: > >> > [ Inside Technologies ] >> > ..."In public-key cryptography, 512-bit keys are typical and >> > already vulnerable. So we are looking at 640-bit-long keys >> > supported by a scalable design." >> >> This kind of thing disgusts me. We already know 512-bit keys are weak. As >> I recall, I was told that 512 bit keys could be cracked in 20,000 >> MIPS-years. If the ballpark formula holds that adding 10 bits doubles the >> security, that merely means that 640 bits is 2**(128/10) or 8000 times >> strong. While obviously better than 512, it is not ENOUGH better to make me >> confident that this is a long-term secure length. 768 or 1024 bits should >> be considered the minimum. A deliberate design of 640 bits makes it look >> like it's intended to be crackable in 5-10 years, much as DES was suspected >> of a similar design decision in limiting its keylength to 56 bits. > >But the "scalable design" presumably means the hardware can deal >with a variety of modulus lengths. As you say, they would be >short-sighted to make a fixed choice. I hope you're right about this. But there's something to keep in mind. Let's suppose that in 10 years 640 bits are "easily" cracked. Anybody with the storage (money) to keep all these messages will have the power to sort through everything you said in 1996, '10 years later.' Who has the money to even store these messages, as well as the inclination? You guessed it, the government. I realize that it is arguable that this would be possible, no matter what keylength is chosen. True, someday 1024-bit keys might be easily cracked, but that will probably be 30-50 years from now, not 10. In other words, "stretching" the technology today on the "encrypt" side makes storing these messages far less attractive, meaning that the government will have less motivation to do it, and will not be able to make the effort pay off for a few more decades. I would like to see laws: 1. Prohibiting the government from storing encrypted messages it can't currently decrypt for over, say, a couple of years. 1a. Prohibiting any USE by the government of such messages obtained and stored by other entities, including individuals and private corporations, without the express permission of the sender AND receiver of the message. 2. Prohibiting the government from even ATTEMPTING to decrypt a domestically-obtained encrypted message, without a warrant which is simultaneously given to the source of the message: In other words, alerting him to the government's interest. This is just a start. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMREY2/qHVDBboB2dAQGZdgP+MjIK02fU6iysN77g1aWb1gx9bzDrZoh4 ePWmd9RRD3gnzYOSIng5dRCxEpT+0Cqe4cFQEqbD6GhHlfNOKwkTU/LAfhvOdKpo QJ9t93Af3aCaLtFmtXyj1Ce20GNqkp7qqP5DLKjYSEH/bR64aTA0pfZ70aes/8C1 w1AYLdvglXA= =p+3A -----END PGP SIGNATURE-----

2 1

American Banker article on First Virtual
by Thomas C. Allard 17 Dec '03

17 Dec '03

PGP message

1 0

DSN
by Laszlo Vecsey 17 Dec '03

17 Dec '03

Anyone heard of DSN? I think thats the right order of the initials... ... its supposedly the only crypto-hardware solution for protecting an entire network on the Internet. You put one of these $5,000 units at one end of a lan, and another one somewhere else on the Internet, and the company gaurantees secure, encrypted transmissions. The TCP/IP headers and data are mangled, encrypted, etc. It uses 512bit keys and I was just wondering how the authentication is done. Does anyone have any specs on these units? Supposedly it does not require a 3rd party entity to verify that the two units are both valid, when determining the initial public/key pairs. Perhaps there is hardcoded data in the units that is used to verify this? The company supposedly has some proprierty method ... how can we be sure this expensive unit can do its job if information on the encryption has not been released. Is there any freeware software solution that has been put through more of a torture test, and proven to work? It seems to be the best approach would be to put such a program on a server that is acting as the gateway/firewall on each network. (define(RSA m e n)(list->string(u(r(s(string->list m))e n))))(define(u a)(if(> a 0)(cons(integer->char(modulo a 256))(u(quotient a 256)))'()))(define(s a)(if (null? a)0(+(char->integer(car a))(* 256(s(cdr a))))))(define(r a x n)(cond((= 0 x)1)((even? x)(modulo(expt(r a(/ x 2)n)2)n))(#t(modulo(* a(r a(1- x)n))n)))) "SGI and Linux both run Motif and X11. They both compile c++ cleanly (using gnu g++). They're the same!"

1 0

Unscribe
by Ewout Meij 17 Dec '03

17 Dec '03

unscribe cypherpunks(a)toad.com unscribe emeij(a)pi.net There is a theory which states that if ever anyone discovers exactly what the Universe is for and why it is here, it will instantly disappear and be replaced by something even more bizarre and inexplicable. There is another which states that this has already happened on 02/01/96

1 0

RC2 Source Code - Legal Warning from RSADSI
by baldwin 17 Dec '03

17 Dec '03

WARNING NOTICE It has recently come to the attention of RSA Data Security, Inc. that certain of its confidential and proprietary source code has been misappropriated and disclosed. Despite such unauthorized use and disclosure, RSA Data Security reserves all intellectual property rights in such source code under applicable law, including without limitation trade secret and copyright protection. In particular, RSA Data Security's RC2 (TM) symmetric block cipher source code has been illegally misappropriated and published. Please be advised that these acts, as well as any retransmission or use of this source code, is a violation of trade secret, copyright and various other state and federal laws. Any person or entity that acquires, discloses or uses this information without authorization or license to do so from RSA Data Security, Inc. is in violation of such laws and subject to applicable criminal and civil penalties, which may include monetary and punitive damages, payment of RSA's attorneys fees and other equitable relief. RSA Data Security considers misappropriation of its intellectual property to be most serious. Not only is this act a violation of law, but its publication is yet another abuse of the Internet. RSA has begun an investigation and will proceed with appropriate action against anyone found to have violated its intellectual property rights. Anyone having information about the misappropriation identified above is encouraged to contact RSA directly.

2 1